v1.0.0 — Security Audit + 15 Remediations

🔒 Security Audit & Hardening Release

Complete security audit covering 10 domains (authentication, input validation, S3, LLM, web, network, cryptography, configuration, error handling, supply chain). Report: DESIGN/live-mem/AUDIT_SECURITE_2026-03-24.md — 27 findings mapped to OWASP API Security Top 10.

15 vulnerabilities fixed — 56/56 tests PASS.

🔴 Critical (3)

• VULN-01 — Race condition in validate_token() — last_used_at now in-memory cache
• VULN-02 — check_access() added to all 5 /api/* REST endpoints
• VULN-07 — Size limits enforced (content 100K, rules 50K, description 500 chars)

🟠 High (6)

• VULN-03 — Token hash prefix: min 16 chars + ambiguity detection
• VULN-08 — space_id regex validation in check_access()
• VULN-12 — Graph Memory token masked in API responses
• VULN-17 — CORS header removed (same-origin, no need)
• VULN-25 — Server refuses to start with weak/default bootstrap key

🟡 Medium (5)

• VULN-04 — hmac.compare_digest() for bootstrap key (constant-time)
• VULN-09 — Filename path traversal validation
• VULN-10 — live_read limit capped at 500
• VULN-13 — delete_many() errors now logged
• VULN-27 — safe_error() centralized helper — 34 except blocks in 6 tools files

🟢 Low (1)

• VULN-11 — bank_relpath() in REST API _api_bank_list

📊 Stats

• 19 files changed, 1110 insertions, 106 deletions
• 56/56 tests PASS (recette 8, isolation 22, qualité 26)
• Full audit report: AUDIT_SECURITE_2026-03-24.md